610b206a031672a19728ad5f8602bb55cde2b935adc3e3963f76c9681375e893

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 15:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_75146eed44e447ff02a8c567a4563625_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260820-speseszdlb
SHA256 610b206a031672a19728ad5f8602bb55cde2b935adc3e3963f76c9681375e893
MD5 75146eed44e447ff02a8c567a4563625
SHA1 ca60e6a1585905c0f161b32ffc30b29015304fef
SHA512 46cd0f9d32369c2c9e36988e53660aa09fd46505a38e12406a735e701f48caa015133c2a63b4846cc089cb860fc66f9ee6429256da0e696434e643d257078db4
SSDEEP 3072:JGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:4XY4LK+a3lLNngoqRttA7
TLSH
T19C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2128	CP.exe
5632	ztrljeywqo.exe
6344	CP.exe
2812	CP.exe
1976	i_ztrljeywqo.exe
5512	bytrljdbvt.sys
6976	CP.exe
6912	ywigbytqlj.exe
1684	CP.exe
3904	CP.exe
3808	i_ywigbytqlj.exe
1752	bvtqligayt.sys
4080	CP.exe
5016	vtnlgdytql.exe
4436	CP.exe
1876	CP.exe
4200	i_vtnlgdytql.exe
772	aysqkigays.sys
6500	CP.exe
4548	aysqkidavt.exe
3700	CP.exe
2356	CP.exe
4808	i_aysqkidavt.exe
1340	dxnifaysqk.sys
1384	CP.exe
1764	ifaxsqkica.exe
5876	CP.exe
2764	CP.exe
596	i_ifaxsqkica.exe
2580	kicaxspkhf.sys
1512	CP.exe
4480	fzxrpkhczu.exe
4340	CP.exe
6652	CP.exe
6824	i_fzxrpkhczu.exe
4276	ecauspkhca.sys
5412	CP.exe
5416	hfzxrpkhca.exe
6100	CP.exe
2320	CP.exe
5320	i_hfzxrpkhca.exe
6908	jhbzurmkec.sys
2856	CP.exe
1196	jhezxrpjhb.exe
5344	CP.exe
4656	CP.exe
4400	i_jhezxrpjhb.exe
4768	trmjhezwuj.sys
4260	CP.exe
1760	mgebwtojgb.exe
2200	CP.exe
2948	CP.exe
3124	i_mgebwtojgb.exe
4184	trojdbwtom.sys
1272	CP.exe
6584	rljdbwtomy.exe
6596	CP.exe
5288	CP.exe
6736	i_rljdbwtomy.exe
1100	olgdyvtnlg.sys
2096	CP.exe
2120	lgdyvtqoig.exe
6008	CP.exe
1612	CP.exe

Loads dropped DLL 1 IoCs

pid	Process
6456	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_1725805853\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_1332589643\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_1275712087\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_1725805853\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_1275712087\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_1725805853\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_1332589643\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_6456_1464708031\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_1764817788\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6456_503427447\_locales\es\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgebwtojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbwtomy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtrmjebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkidxvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywigbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbwtomy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdyvtqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkifdysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpkhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurmjhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwromgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkidxvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkifdysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkifaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkifaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czurmjhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpnhfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpnhfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywigbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlgdytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpkhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgebwtojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdyvtqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_75146eed44e447ff02a8c567a4563625_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlgdytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwromgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtrmjebwu.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6380	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6564	ipconfig.exe
6192	ipconfig.exe
2244	ipconfig.exe
6896	ipconfig.exe
2340	ipconfig.exe
4252	ipconfig.exe
6692	ipconfig.exe
6508	ipconfig.exe
2580	ipconfig.exe
2028	ipconfig.exe
1748	ipconfig.exe
4756	ipconfig.exe
2696	ipconfig.exe
3256	ipconfig.exe
4560	ipconfig.exe
2600	ipconfig.exe
4112	ipconfig.exe
7084	ipconfig.exe
1340	ipconfig.exe
2716	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317126740914619"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{7DF09DBC-FCF1-40E1-9CCC-91EBBC76D55C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
7024	msedge.exe
7024	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
6456	msedge.exe
6456	msedge.exe
6456	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1976	i_ztrljeywqo.exe
Token: SeDebugPrivilege	3808	i_ywigbytqlj.exe
Token: SeDebugPrivilege	4200	i_vtnlgdytql.exe
Token: SeDebugPrivilege	4808	i_aysqkidavt.exe
Token: SeDebugPrivilege	596	i_ifaxsqkica.exe
Token: SeDebugPrivilege	6824	i_fzxrpkhczu.exe
Token: SeDebugPrivilege	5320	i_hfzxrpkhca.exe
Token: SeDebugPrivilege	4400	i_jhezxrpjhb.exe
Token: SeDebugPrivilege	3124	i_mgebwtojgb.exe
Token: SeDebugPrivilege	6736	i_rljdbwtomy.exe
Token: SeDebugPrivilege	5940	i_lgdyvtqoig.exe
Token: SeDebugPrivilege	5208	i_qkidxvtnlf.exe
Token: SeDebugPrivilege	5068	i_qkifdysqki.exe
Token: SeDebugPrivilege	1188	i_vsnkifaxsq.exe
Token: SeDebugPrivilege	3484	i_zxrpnhfcxv.exe
Token: SeDebugPrivilege	2716	i_czurmjhezw.exe
Token: SeDebugPrivilege	4640	i_zwromgezwr.exe
Token: SeDebugPrivilege	4432	i_bwtrmjebwu.exe
Token: SeDebugPrivilege	2172	i_vtolgeywqo.exe
Token: SeDebugPrivilege	4904	i_qoigdbvtnl.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6456	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 5268	4280	2026-08-20_75146eed44e447ff02a8c567a4563625_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 5268 wrote to memory of 6456	5268	iexplore.exe	91
PID 6456 wrote to memory of 4132	6456	msedge.exe	92
PID 6456 wrote to memory of 6380	6456	msedge.exe	93
PID 6456 wrote to memory of 436	6456	msedge.exe	96
PID 6456 wrote to memory of 436	6456	msedge.exe	96
PID 6456 wrote to memory of 4320	6456	msedge.exe	94
PID 6456 wrote to memory of 4320	6456	msedge.exe	94
PID 6456 wrote to memory of 4320	6456	msedge.exe	94
PID 6456 wrote to memory of 6704	6456	msedge.exe	97
PID 6456 wrote to memory of 6704	6456	msedge.exe	97
PID 6456 wrote to memory of 6704	6456	msedge.exe	97
PID 6456 wrote to memory of 6748	6456	msedge.exe	98
PID 6456 wrote to memory of 6748	6456	msedge.exe	98
PID 6456 wrote to memory of 6748	6456	msedge.exe	98
PID 4280 wrote to memory of 2128	4280	2026-08-20_75146eed44e447ff02a8c567a4563625_elex_redline-stealer_rhadamanthys_stop.exe	99
PID 6456 wrote to memory of 3120	6456	msedge.exe	100
PID 6456 wrote to memory of 5184	6456	msedge.exe	101
PID 6456 wrote to memory of 3120	6456	msedge.exe	100
PID 6456 wrote to memory of 5184	6456	msedge.exe	101
PID 6456 wrote to memory of 2764	6456	msedge.exe	104
PID 5632 wrote to memory of 6344	5632	ztrljeywqo.exe	106
PID 4280 wrote to memory of 2812	4280	2026-08-20_75146eed44e447ff02a8c567a4563625_elex_redline-stealer_rhadamanthys_stop.exe	111
PID 4280 wrote to memory of 6976	4280	2026-08-20_75146eed44e447ff02a8c567a4563625_elex_redline-stealer_rhadamanthys_stop.exe	115
PID 6912 wrote to memory of 1684	6912	ywigbytqlj.exe	117
PID 4280 wrote to memory of 3904	4280	2026-08-20_75146eed44e447ff02a8c567a4563625_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 4280 wrote to memory of 4080	4280	2026-08-20_75146eed44e447ff02a8c567a4563625_elex_redline-stealer_rhadamanthys_stop.exe	124
PID 5016 wrote to memory of 4436	5016	vtnlgdytql.exe	126
PID 4280 wrote to memory of 1876	4280	2026-08-20_75146eed44e447ff02a8c567a4563625_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 4280 wrote to memory of 6500	4280	2026-08-20_75146eed44e447ff02a8c567a4563625_elex_redline-stealer_rhadamanthys_stop.exe	133
PID 4548 wrote to memory of 3700	4548	aysqkidavt.exe	135
PID 4280 wrote to memory of 2356	4280	2026-08-20_75146eed44e447ff02a8c567a4563625_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 6456 wrote to memory of 5896	6456	msedge.exe	141
PID 6456 wrote to memory of 5952	6456	msedge.exe	142
PID 6456 wrote to memory of 3188	6456	msedge.exe	143
PID 6456 wrote to memory of 3964	6456	msedge.exe	146
PID 6456 wrote to memory of 3964	6456	msedge.exe	146
PID 6456 wrote to memory of 1500	6456	msedge.exe	147
PID 6456 wrote to memory of 1500	6456	msedge.exe	147
PID 4280 wrote to memory of 1384	4280	2026-08-20_75146eed44e447ff02a8c567a4563625_elex_redline-stealer_rhadamanthys_stop.exe	148
PID 1764 wrote to memory of 5876	1764	ifaxsqkica.exe	150
PID 4280 wrote to memory of 2764	4280	2026-08-20_75146eed44e447ff02a8c567a4563625_elex_redline-stealer_rhadamanthys_stop.exe	153
PID 4280 wrote to memory of 1512	4280	2026-08-20_75146eed44e447ff02a8c567a4563625_elex_redline-stealer_rhadamanthys_stop.exe	157
PID 4480 wrote to memory of 4340	4480	fzxrpkhczu.exe	159
PID 4280 wrote to memory of 6652	4280	2026-08-20_75146eed44e447ff02a8c567a4563625_elex_redline-stealer_rhadamanthys_stop.exe	162
PID 4280 wrote to memory of 5412	4280	2026-08-20_75146eed44e447ff02a8c567a4563625_elex_redline-stealer_rhadamanthys_stop.exe	166
PID 5416 wrote to memory of 6100	5416	hfzxrpkhca.exe	168
PID 4280 wrote to memory of 2320	4280	2026-08-20_75146eed44e447ff02a8c567a4563625_elex_redline-stealer_rhadamanthys_stop.exe	171
PID 4280 wrote to memory of 2856	4280	2026-08-20_75146eed44e447ff02a8c567a4563625_elex_redline-stealer_rhadamanthys_stop.exe	175
PID 1196 wrote to memory of 5344	1196	jhezxrpjhb.exe	177
PID 4280 wrote to memory of 4656	4280	2026-08-20_75146eed44e447ff02a8c567a4563625_elex_redline-stealer_rhadamanthys_stop.exe	180
PID 6456 wrote to memory of 4328	6456	msedge.exe	182
PID 6456 wrote to memory of 4328	6456	msedge.exe	182
PID 4280 wrote to memory of 4260	4280	2026-08-20_75146eed44e447ff02a8c567a4563625_elex_redline-stealer_rhadamanthys_stop.exe	187
PID 1760 wrote to memory of 2200	1760	mgebwtojgb.exe	189
PID 4280 wrote to memory of 2948	4280	2026-08-20_75146eed44e447ff02a8c567a4563625_elex_redline-stealer_rhadamanthys_stop.exe	192
PID 4280 wrote to memory of 1272	4280	2026-08-20_75146eed44e447ff02a8c567a4563625_elex_redline-stealer_rhadamanthys_stop.exe	196
PID 6584 wrote to memory of 6596	6584	rljdbwtomy.exe	198
PID 4280 wrote to memory of 5288	4280	2026-08-20_75146eed44e447ff02a8c567a4563625_elex_redline-stealer_rhadamanthys_stop.exe	201
PID 6456 wrote to memory of 3696	6456	msedge.exe	203
PID 6456 wrote to memory of 3696	6456	msedge.exe	203
PID 4280 wrote to memory of 2096	4280	2026-08-20_75146eed44e447ff02a8c567a4563625_elex_redline-stealer_rhadamanthys_stop.exe	206
PID 2120 wrote to memory of 6008	2120	lgdyvtqoig.exe	208
PID 4280 wrote to memory of 1612	4280	2026-08-20_75146eed44e447ff02a8c567a4563625_elex_redline-stealer_rhadamanthys_stop.exe	211

C:\Users\Admin\AppData\Local\Temp\2026-08-20_75146eed44e447ff02a8c567a4563625_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_75146eed44e447ff02a8c567a4563625_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x300,0x7ffbb43cc188,0x7ffbb43cc194,0x7ffbb43cc1a0
      4⤵
      PID:4132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,4661767645057695306,12324658392889785096,524288 --field-trial-handle=2272,i,17814250965548718679,13765410281924325287,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:11
      4⤵
      System Time Discovery
      PID:6380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,6042214589970607098,7334313986742400295,262144 --field-trial-handle=2272,i,17814250965548718679,13765410281924325287,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,4106206518913963975,2723606729591420253,524288 --field-trial-handle=2272,i,17814250965548718679,13765410281924325287,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:13
      4⤵
      PID:436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,10174898795603275823,8462451241035704807,2097152 --field-trial-handle=2272,i,17814250965548718679,13765410281924325287,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:6704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,14624665721792405804,7545361539720898758,2097152 --field-trial-handle=2272,i,17814250965548718679,13765410281924325287,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:6748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,7470855170427186442,6083607712263045347,524288 --field-trial-handle=2272,i,17814250965548718679,13765410281924325287,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
      4⤵
      PID:3120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,10937072101414050988,5798260115833336296,524288 --field-trial-handle=2272,i,17814250965548718679,13765410281924325287,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
      4⤵
      PID:5184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,1954664706601167791,4293325240987862342,524288 --field-trial-handle=2272,i,17814250965548718679,13765410281924325287,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
      4⤵
      PID:1680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,1954664706601167791,4293325240987862342,524288 --field-trial-handle=2272,i,17814250965548718679,13765410281924325287,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
      4⤵
      PID:2764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,8173887949542428620,12070416460256412648,524288 --field-trial-handle=2272,i,17814250965548718679,13765410281924325287,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
      4⤵
      PID:5896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,435515100505515680,49998506937986830,524288 --field-trial-handle=2272,i,17814250965548718679,13765410281924325287,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
      4⤵
      PID:5952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,3578043680634835959,4718734464668557528,524288 --field-trial-handle=2272,i,17814250965548718679,13765410281924325287,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
      4⤵
      PID:3188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3216,i,13735029215661229097,3850284658847798877,524288 --field-trial-handle=2272,i,17814250965548718679,13765410281924325287,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
      4⤵
      PID:3964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,11860987489357364942,8207484346807111562,524288 --field-trial-handle=2272,i,17814250965548718679,13765410281924325287,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:14
      4⤵
      PID:1500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,12175587652884842865,17146721385930736351,524288 --field-trial-handle=2272,i,17814250965548718679,13765410281924325287,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:14
      4⤵
      PID:4328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,4215835652518724191,5429161718526329115,524288 --field-trial-handle=2272,i,17814250965548718679,13765410281924325287,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
      4⤵
      PID:3696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,15375869937259203504,3178699632591344298,524288 --field-trial-handle=2272,i,17814250965548718679,13765410281924325287,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
      4⤵
      PID:6708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,10871400329485194064,6427708409864248802,524288 --field-trial-handle=2272,i,17814250965548718679,13765410281924325287,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
      4⤵
      PID:6848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6848,i,5781200331734156675,14642189490975065174,262144 --field-trial-handle=2272,i,17814250965548718679,13765410281924325287,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,13079223458876420838,2155849684705886243,524288 --field-trial-handle=2272,i,17814250965548718679,13765410281924325287,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
      4⤵
      PID:4668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrljeywqo.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2128
- - C:\Temp\ztrljeywqo.exe
    C:\Temp\ztrljeywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5632
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6344
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrljeywqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2812
- - C:\Temp\i_ztrljeywqo.exe
    C:\Temp\i_ztrljeywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywigbytqlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6976
- - C:\Temp\ywigbytqlj.exe
    C:\Temp\ywigbytqlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6912
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1684
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywigbytqlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3904
- - C:\Temp\i_ywigbytqlj.exe
    C:\Temp\i_ywigbytqlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlgdytql.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4080
- - C:\Temp\vtnlgdytql.exe
    C:\Temp\vtnlgdytql.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlgdytql.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1876
- - C:\Temp\i_vtnlgdytql.exe
    C:\Temp\i_vtnlgdytql.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqkidavt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6500
- - C:\Temp\aysqkidavt.exe
    C:\Temp\aysqkidavt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3700
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqkidavt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2356
- - C:\Temp\i_aysqkidavt.exe
    C:\Temp\i_aysqkidavt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaxsqkica.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1384
- - C:\Temp\ifaxsqkica.exe
    C:\Temp\ifaxsqkica.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5876
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:7084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaxsqkica.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2764
- - C:\Temp\i_ifaxsqkica.exe
    C:\Temp\i_ifaxsqkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxrpkhczu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1512
- - C:\Temp\fzxrpkhczu.exe
    C:\Temp\fzxrpkhczu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4340
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxrpkhczu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6652
- - C:\Temp\i_fzxrpkhczu.exe
    C:\Temp\i_fzxrpkhczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxrpkhca.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5412
- - C:\Temp\hfzxrpkhca.exe
    C:\Temp\hfzxrpkhca.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5416
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6100
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxrpkhca.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2320
- - C:\Temp\i_hfzxrpkhca.exe
    C:\Temp\i_hfzxrpkhca.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhezxrpjhb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2856
- - C:\Temp\jhezxrpjhb.exe
    C:\Temp\jhezxrpjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1196
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5344
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhezxrpjhb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4656
- - C:\Temp\i_jhezxrpjhb.exe
    C:\Temp\i_jhezxrpjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgebwtojgb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4260
- - C:\Temp\mgebwtojgb.exe
    C:\Temp\mgebwtojgb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1760
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2200
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgebwtojgb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2948
- - C:\Temp\i_mgebwtojgb.exe
    C:\Temp\i_mgebwtojgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljdbwtomy.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1272
- - C:\Temp\rljdbwtomy.exe
    C:\Temp\rljdbwtomy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6584
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6596
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljdbwtomy.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5288
- - C:\Temp\i_rljdbwtomy.exe
    C:\Temp\i_rljdbwtomy.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgdyvtqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2096
- - C:\Temp\lgdyvtqoig.exe
    C:\Temp\lgdyvtqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2120
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6008
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgdyvtqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1612
- - C:\Temp\i_lgdyvtqoig.exe
    C:\Temp\i_lgdyvtqoig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkidxvtnlf.exe ups_run
  2⤵
  PID:1940
- - C:\Temp\qkidxvtnlf.exe
    C:\Temp\qkidxvtnlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3532
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2864
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkidxvtnlf.exe ups_ins
  2⤵
  PID:2180
- - C:\Temp\i_qkidxvtnlf.exe
    C:\Temp\i_qkidxvtnlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkifdysqki.exe ups_run
  2⤵
  PID:204
- - C:\Temp\qkifdysqki.exe
    C:\Temp\qkifdysqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4172
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkifdysqki.exe ups_ins
  2⤵
  PID:5376
- - C:\Temp\i_qkifdysqki.exe
    C:\Temp\i_qkifdysqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnkifaxsq.exe ups_run
  2⤵
  PID:1088
- - C:\Temp\vsnkifaxsq.exe
    C:\Temp\vsnkifaxsq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3216
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6052
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnkifaxsq.exe ups_ins
  2⤵
  PID:5832
- - C:\Temp\i_vsnkifaxsq.exe
    C:\Temp\i_vsnkifaxsq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpnhfcxv.exe ups_run
  2⤵
  PID:5692
- - C:\Temp\zxrpnhfcxv.exe
    C:\Temp\zxrpnhfcxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6768
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4568
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpnhfcxv.exe ups_ins
  2⤵
  PID:3964
- - C:\Temp\i_zxrpnhfcxv.exe
    C:\Temp\i_zxrpnhfcxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czurmjhezw.exe ups_run
  2⤵
  PID:3124
- - C:\Temp\czurmjhezw.exe
    C:\Temp\czurmjhezw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4208
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czurmjhezw.exe ups_ins
  2⤵
  PID:2792
- - C:\Temp\i_czurmjhezw.exe
    C:\Temp\i_czurmjhezw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwromgezwr.exe ups_run
  2⤵
  PID:1796
- - C:\Temp\zwromgezwr.exe
    C:\Temp\zwromgezwr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2072
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwromgezwr.exe ups_ins
  2⤵
  PID:2784
- - C:\Temp\i_zwromgezwr.exe
    C:\Temp\i_zwromgezwr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwtrmjebwu.exe ups_run
  2⤵
  PID:1304
- - C:\Temp\bwtrmjebwu.exe
    C:\Temp\bwtrmjebwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2504
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwtrmjebwu.exe ups_ins
  2⤵
  PID:5820
- - C:\Temp\i_bwtrmjebwu.exe
    C:\Temp\i_bwtrmjebwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtolgeywqo.exe ups_run
  2⤵
  PID:2252
- - C:\Temp\vtolgeywqo.exe
    C:\Temp\vtolgeywqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6708
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtolgeywqo.exe ups_ins
  2⤵
  PID:6040
- - C:\Temp\i_vtolgeywqo.exe
    C:\Temp\i_vtolgeywqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigdbvtnl.exe ups_run
  2⤵
  PID:6868
- - C:\Temp\qoigdbvtnl.exe
    C:\Temp\qoigdbvtnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3936
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2852
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigdbvtnl.exe ups_ins
  2⤵
  PID:5444
- - C:\Temp\i_qoigdbvtnl.exe
    C:\Temp\i_qoigdbvtnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5136

C:\Temp\bytrljdbvt.sys
C:\Temp\bytrljdbvt.sys
1⤵
- Executes dropped EXE
PID:5512

C:\Temp\bvtqligayt.sys
C:\Temp\bvtqligayt.sys
1⤵
- Executes dropped EXE
PID:1752

C:\Temp\aysqkigays.sys
C:\Temp\aysqkigays.sys
1⤵
- Executes dropped EXE
PID:772

C:\Temp\dxnifaysqk.sys
C:\Temp\dxnifaysqk.sys
1⤵
- Executes dropped EXE
PID:1340

C:\Temp\kicaxspkhf.sys
C:\Temp\kicaxspkhf.sys
1⤵
- Executes dropped EXE
PID:2580

C:\Temp\ecauspkhca.sys
C:\Temp\ecauspkhca.sys
1⤵
- Executes dropped EXE
PID:4276

C:\Temp\jhbzurmkec.sys
C:\Temp\jhbzurmkec.sys
1⤵
- Executes dropped EXE
PID:6908

C:\Temp\trmjhezwuj.sys
C:\Temp\trmjhezwuj.sys
1⤵
- Executes dropped EXE
PID:4768

C:\Temp\trojdbwtom.sys
C:\Temp\trojdbwtom.sys
1⤵
- Executes dropped EXE
PID:4184

C:\Temp\olgdyvtnlg.sys
C:\Temp\olgdyvtnlg.sys
1⤵
- Executes dropped EXE
PID:1100

C:\Temp\lidayvqoig.sys
C:\Temp\lidayvqoig.sys
1⤵
PID:4164

C:\Temp\avtnlfdyvq.sys
C:\Temp\avtnlfdyvq.sys
1⤵
PID:2804

C:\Temp\vsnkifaxsq.sys
C:\Temp\vsnkifaxsq.sys
1⤵
PID:5496

C:\Temp\axrpkhcaus.sys
C:\Temp\axrpkhcaus.sys
1⤵
PID:5724

C:\Temp\bzurpmkecw.sys
C:\Temp\bzurpmkecw.sys
1⤵
PID:7060

C:\Temp\mkecwuomhe.sys
C:\Temp\mkecwuomhe.sys
1⤵
PID:2456

C:\Temp\ebwuomjecw.sys
C:\Temp\ebwuomjecw.sys
1⤵
PID:7016

C:\Temp\wqoljdbvto.sys
C:\Temp\wqoljdbvto.sys
1⤵
PID:1856

C:\Temp\tnljdbvtnl.sys
C:\Temp\tnljdbvtnl.sys
1⤵
PID:5476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqkidavt.exe

Path C:\Temp\aysqkidavt.exe
Size 226KB
SHA256 5dfc89f7c1a8fd0945727a143d99d535a9d445a169997081ba64c5222e986ba2
MD5 3ab2b297f29fe58e79f1fcb356c09961
SHA1 c0a04d79ac41c48dfad234895884d6a16cbb25ad
SHA512 5b1de1babcb4f8f40419be910d1b0d3cfe16c1ad1b1ec5098b554d0251f00e11a0fb127b92bab5fd689e4a03a99f3a39522b4a0835a7a7f4ec02d12a78a3e586
SSDEEP 3072:HGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:mXY4LK+a3lLNngoqRttA7
TLSH
T1F034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqkigays.sys

Path C:\Temp\aysqkigays.sys
Size 141KB
SHA256 a419e4b6f99999b5c8974ee9aef7aed528f4c4b9917da49ab6dde2b5293bbdde
MD5 a47922c3a5661bfb36009d831940a439
SHA1 ab04100df26bc0255cbb589b3a9edd2fbe909d63
SHA512 20da458dc6e14cdf4a58d3d0ae967139028a1e47e594306e27497c55edf14d67ac3ad5f6b9ada7eb8163390bac54e5cad9184c4063ac27e8f1b0e0d300b2fd98
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11AE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtqligayt.sys

Path C:\Temp\bvtqligayt.sys
Size 141KB
SHA256 b4bd8065c648d6995a43dbf540a9870adeec33b2ca8b911868c19b0326008623
MD5 fd9a0c0fb35844da56b748bfb4ea0cb3
SHA1 e0189cb85d4881af376ae2e5c2322a16c2d8851e
SHA512 9d1913c9f53a38f16458138b6fece20c6ee5f6950f865dba141c5a2ce75ac5e22c057767791422c8f2676a8c55998d416af4dc61c4690a29ce8968c66411f205
SSDEEP 1536:ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1EAE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytrljdbvt.sys

Path C:\Temp\bytrljdbvt.sys
Size 141KB
SHA256 cdcd6d57a163115e07ea04f1509398239b0fc8b307b046d31fa64cd033b28a28
MD5 56bf42a5e509e5d222a4aab5a2631b63
SHA1 44209b640c1f068a88e1a142358999a6ad8d7352
SHA512 c074265f90e61b77a21e887fe05cba7adbde893683a8864471a1196dab8989069e764624b9313830dfbe34afbb02d2f1e3615ba69798fd967b4466cfd4fe50b7
SSDEEP 1536:4a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:4a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T140E38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxnifaysqk.sys

Path C:\Temp\dxnifaysqk.sys
Size 141KB
SHA256 55816864a66fd3afacc1b91b9bf74365952bb6c0dcccc6d030c43ec7057c61b7
MD5 8dd08584a0658a0c03e802deba2307d0
SHA1 e8505a2dd53240f0775efee23cc4110340523a3e
SHA512 ae61e04e8612e6b6de10719f45e4b53b457d6ed90c978b56ba1a978a3b1abccc69faeb08e10e2dce1b3ce9ad307a8a36f9733508b21ba2a5394961148c9d4bb2
SSDEEP 1536:na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T129E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecauspkhca.sys

Path C:\Temp\ecauspkhca.sys
Size 141KB
SHA256 626fe40d072421539407548716c0e6ebffe8e6fbed594e024f434d908a0d6289
MD5 f21c095fd0661b9a89f84715474c3391
SHA1 b8eb15ea864eb795e475fb8968707a7d26000053
SHA512 39bcb7c2a49cea96e092bbc58c8a0c78c8a721debdc4dd071c038fdc3276b8c861d345ee48ddb1851d0412e8e170b18a1f9ba6092b5e36d3eb1c307732148ce7
SSDEEP 1536:Ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1FCE37C12B292D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxrpkhczu.exe

Path C:\Temp\fzxrpkhczu.exe
Size 226KB
SHA256 aee0b8bb944299fa9b85e2518549a9c18450eed227b59db609a7a9a5c3b66d7b
MD5 eb5c245824df8f0e7d0233248220854f
SHA1 2697870963635f9c2b79b970253fc29ce93635fe
SHA512 52a68c3d9f84749590c4f904f6bbdb7e2ee63308e60e27bde9e4b38eb51b39ca6a1419b2599acad223fb5de51dec27ed45e1315e58dcb4caa2bc4700193badf1
SSDEEP 3072:iGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:JXY4LK+a3lLNngoqRttA7
TLSH
T16A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxrpkhca.exe

Path C:\Temp\hfzxrpkhca.exe
Size 226KB
SHA256 151c87126d87e6a5a1a19fe3de6791696ac005a6ffd6741d8be70eb152dedfcf
MD5 7d7b068c61302cbfe3a200b434516f5d
SHA1 a2f1bedb6cc8e23fcf776f6bc206d00c367f93cf
SHA512 7b56713f3fd5002516c476fda915208cbb360836a55f7bb9eb423ba9ef5008d91ef94ea103c1967cd55e892028ff6d86d4e7a47cbd5c328cefda922be9f7f9a8
SSDEEP 3072:ZGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:IXY4LK+a3lLNngoqRttA7
TLSH
T12234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aysqkidavt.exe

Path C:\Temp\i_aysqkidavt.exe
Size 226KB
SHA256 88417e24b6e5477b1631b457ef550917524b9b56fbd39c274e9ba3cc7ddb4d31
MD5 17590663e2452f135c37c87692740b87
SHA1 9fe4b6fa4653d9ad3fcd19316b50b3911d6f6a4f
SHA512 84edfefeae9231812b3e719afc32c29f93a561161f46687e7eb2f1b649194d6ade9b06c6f1594c363454ab051b3bcc429742ba93d242061e9dbcb07ae74c23e6
SSDEEP 3072:uGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:FXY4LK+a3lLNngoqRttA7
TLSH
T12834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxrpkhczu.exe

Path C:\Temp\i_fzxrpkhczu.exe
Size 226KB
SHA256 ab91410c7d52c6bfbc0767093475b9047b6b7a2766bd66f53bd34fd53d3b9805
MD5 9842357dd401f368cbe6e168f8327128
SHA1 5a0c1e9203b5cdf1622313db85432b40e7ea16d0
SHA512 63c2349e47d58b5947be0199c3595f00e47f0912952d6da1726b02f4dbfb75c2062fb80e85e0dc9461d44483c292368ac22f4a2c3fd7414f5968b8baafa7729b
SSDEEP 3072:uGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:FXY4LK+a3lLNngoqRttA7
TLSH
T1FF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifaxsqkica.exe

Path C:\Temp\i_ifaxsqkica.exe
Size 226KB
SHA256 4f65686729eaab414eb7d8fe62abc0b25cae3dbfec64fb87f080f3e686b55531
MD5 60e9af8620369725947e8d6df04ddeaa
SHA1 955a6fe910f9c7f5345b595ed8d58c4cfcc949ff
SHA512 737197c7a9ed4f7af639f6abdd169ab175d9b1b495429981e5d0d53382d4dd2bad3de8f08757f399a80aa9865365cd36c10a7c1629f61dfe87533a8d2a7cc9a8
SSDEEP 3072:FGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:kXY4LK+a3lLNngoqRttA7
TLSH
T12A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtnlgdytql.exe

Path C:\Temp\i_vtnlgdytql.exe
Size 226KB
SHA256 6661bb5c7eda610700889d0b6882afdb22420cfb9fac71b20d8710a9c5cbf06c
MD5 d080531a30d863b61798b2686161239c
SHA1 ee5c30866e48c7e59ef642a898ca376e0ef2f49e
SHA512 b81e54233cc63314bc1457757851fd16b792be5ec0d877f36e16edb4fec9183e409bab62fc8f7d8962a93826752146c85249563c7f11720294d910f7a647b11d
SSDEEP 3072:FGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:kXY4LK+a3lLNngoqRttA7
TLSH
T17334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywigbytqlj.exe

Path C:\Temp\i_ywigbytqlj.exe
Size 226KB
SHA256 aa95447b0f73cfa750915a0c8214df350175c98590c43d4a62adc717c3a1f7af
MD5 d525a041005c3d4cbd29909008245f70
SHA1 a3adf525c625dd63a11a196a2daee9f7c63503d7
SHA512 1a79d9b29e0df40f19c457d774bc7f55ed19c4ce21d9d02e9f49e8525e25bfc6f1ce40c9fc448333838ed232340f8f1854b8921decfc51401e7d60a76fede991
SSDEEP 3072:6GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:BXY4LK+a3lLNngoqRttA7
TLSH
T13534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztrljeywqo.exe

Path C:\Temp\i_ztrljeywqo.exe
Size 226KB
SHA256 c9347d09f6c1b6c4e645f61fe233ff68e50d39174bf49b72a7a35f90d9f03238
MD5 b952fac8ff00e21ff41e96ea037c16c3
SHA1 b0615473f9961dbd64e4b0c75eed9d80374dc447
SHA512 1be4222529fd230204947cb52c6b948f4afb51f203ddd89d1aa2151c0f9eba034bd6d6799ae4bc6efb7d5669d7e7ba94ab6d63b5a223542bdfb23926b583ec22
SSDEEP 3072:VGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:0XY4LK+a3lLNngoqRttA7
TLSH
T1CC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaxsqkica.exe

Path C:\Temp\ifaxsqkica.exe
Size 226KB
SHA256 452ef29b41c2785a426eafff78048d73693832f9575dd7b5edaf2e83f2bd8738
MD5 633620269c93bc28e7819e26a168f0de
SHA1 a78d35f50bcb7c9e0901b9027bc942f73fd42239
SHA512 6110675f198e6180155fb8bc114c576321bd7e7e0e38247a788dce9fd7fab5dbdd85197ef2832eee9ec32c2b81a2c4d39c2413109237cdcb12236b01c1ecad2f
SSDEEP 3072:NGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:sXY4LK+a3lLNngoqRttA7
TLSH
T17934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicaxspkhf.sys

Path C:\Temp\kicaxspkhf.sys
Size 141KB
SHA256 8a7ef018db97adc1696573c7b17177783b21a0c19db7d0a9de11dbb30393ac85
MD5 f82793e3a16c55074d643d8ca87f1796
SHA1 1e5f62c13af32c1be203028388cf43426b6d041b
SHA512 b6088bffe4ad372323052b31e3b2467fd31289efc2b8dba4f8d79529007a4f15a1229d956317b4a6f95eec07f76df45c565384246c7a8732a4e26be65d322e1e
SSDEEP 1536:Ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T149E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlgdytql.exe

Path C:\Temp\vtnlgdytql.exe
Size 226KB
SHA256 ab350705092c446a4d5d5f2c2038d3fa7f5319c4b0d9431022e5fe958210e2d5
MD5 e6123681222659879f3e1435e9c15e55
SHA1 2c6d1b88e084e0ab472900530732dcbbfa67900b
SHA512 b819d9e7ca1c7076ebbed504744d2e6b6ab9785a23dc466e5e4608d0ab33e7cb63ccc43b32ecb1498ddc8a17281fa48db91b0e1d4062c63395aaa2e57650cef6
SSDEEP 3072:7GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:6XY4LK+a3lLNngoqRttA7
TLSH
T10B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywigbytqlj.exe

Path C:\Temp\ywigbytqlj.exe
Size 226KB
SHA256 5dc41aa66008bb0c9d5431effef03db59d82614ad7e22f735a266e7964faa5c6
MD5 0317e98a846a02ad450b40616f77b00c
SHA1 c8a9a5bdd5b9a8a2975448976256b06af318871c
SHA512 c00cb6982937e7558f63bfe4746f47bc40ac172c9bf24ddccbfc4dc3c0637e83495f11ae0ae0afcea7fa509b8c2b358ab701f6d5bdb917c37a0ca2a073178025
SSDEEP 3072:UGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:7XY4LK+a3lLNngoqRttA7
TLSH
T13D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljeywqo.exe

Path C:\Temp\ztrljeywqo.exe
Size 226KB
SHA256 b624d34a6dc871d813629dfa3610237d2f0293a3560fa7cc80edaab7e184176c
MD5 1555b498ba87a53a5d01870ba8d8d9a1
SHA1 b5a86ab4dc888e397c30583b0ae245c7832c7ea6
SHA512 3ff3bfb6e590a20c4ac8de01fb70a9a2f89acc8a3ae5c4a863e381689539af5264a511fd23eb1d549cb7544f13453e8f002db00bb3deab5eb8d31ccc87d32b36
SSDEEP 3072:iGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:JXY4LK+a3lLNngoqRttA7
TLSH
T10F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 48449b7037014f199dc66fafe2a83e0f3a5a94d0e60364c4d2dc43641b33c27f
MD5 2d4676bba91647d892a40d95395d03a3
SHA1 405f57210a2077b46522e78c0a2042b16557f5be
SHA512 669b2ed5e553a5f97fd022b9f56fd186b1fff02b5579dd578fc92515a7a559b1fef3d6364c1b3d51d52890eb588a9bf3f391cdab870b663155ed5a8d5395fdea
TLSH
T13AE02B55D820BC2719FC2B2960550B47F750135B3B41C84B3B3D822C8FB26374386C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a8c9c898b7b49f3537d808f7c84470a68c6d4e3edaf510bae72626f443430536
MD5 eabb582e48516ce6ad0ed73cd14cbb2f
SHA1 04b220e6cdf5034a573cc4faef61ca22ccbda26d
SHA512 601671df668e05f9d78d05fd95b148cdebeb5fcc980cd302e38d43aa69197144738024a7fbd2a614abf900ddbc43ee7bc21c9b49e050957310126010b18a50a0
TLSH
T19941BDF383F4856E8A1195F0AA186E2FCE1D0515432C7D5AC9E4AE2BA3E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a3651efa-4326-452b-ad2a-98fd765745f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a3651efa-4326-452b-ad2a-98fd765745f3.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f09e078609c23d9284607516a8d6fba3a69e0797125a067444e522d9c3553518
MD5 ce6a2616198d5507d2eff707d0dfab1e
SHA1 f2453cacce074b0e5ea5bd6d4a06dfc27b8415a5
SHA512 eb1b2fced1fab3bc8e6210ed40eb6021d176dbff0c579ca062b619e4f8849d02f09e502cf462d4e68ca4b884f392c9aaf8918cb119d96825836491f67c8282cb
SSDEEP 384:sxRDu80/fOsbdN/RIkmv/5o/WEYsGQV9qjv:s3z0/fN/Wd/56WEYsGQV9s
TLSH
T1B172D815AA349D7B8CDBE219FA557F93D3F81173A1915E44AAFC8A0C00E66ED211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 a7ea9d6cd9325357f57897dae8948dc9a00391ad576021a3fcb84d30c79b1d12
MD5 918e590a71a50536cfade4da67c7a284
SHA1 39e172f3d4023a349db3c4bf240ff74d04603307
SHA512 ab2b77bb2221bd5aca53e21135bbd5bc5f4e7bffe98c65c055d88df3e621032620787a2630f28a39a2cf46ee7f6f48baa04726f780a46c832704dc3d6032a20e
SSDEEP 384:sxRDuqI0/fOsS2N/RIkmv/5o/WEUsGQV9qTEJ:s3RI0/fk0Wd/56WEUsGQV9x
TLSH
T15E72D715AA345D7B8CDBE219FA957F93D3F85173A1915E44AAFC8A0C00E76ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 2d88ad81a5d8e793f00c102fad75ff4aa68a5b047ef3aee72df8099279cdd203
MD5 4061d0fb983db26ff08db8d3c4101ec8
SHA1 58fbe1e27096d5d155c9f443670858a3e3aff385
SHA512 3ca83018397bf029c5d15a95ddbb1d24a16771784ff2a08311754fb25d78b85054fb99714d968c5ea2821cb01b21d6e0fe19da1a98bca59c97243c298aba0a96
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDobbDwzroD4H:Ob4YZnE7yTWg1NfwBu1ja0obHwAEH
TLSH
T126E2EB3B280CCB7E4F804ADDEC29BD9A6DA801CF5AD8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 f23fb6aa2c01902334e0c3c85edfefcfe4d494825a1c695aee81a17b35fed558
MD5 22fc29a1a374ff5a9715322a4d8adf74
SHA1 2d77250698236b6eea271d42ef29b7c907930b67
SHA512 8488cbdd7ff0a1fe48960f2a480bbefc041964dffa756001e43596f965888284246af81617ea6c0e6a10a26e32b7de033bd3da6934b0fa87581b8ecab5a2c9fe
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9sfZ:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRb
TLSH
T1ADB25D11713F42803C3EB90C8178986F96C2B4637519E52F7BA846A65F67E039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 13362bc8e71167eb93f425055f262ae4c93b4debb840b53732f260e7f0d16199
MD5 1b9b71fa6e47757c76f2f807202072c3
SHA1 e364c2ec5dba6c32418a9452051ea536d3f69000
SHA512 3f943fa80f3fb7ebb3129203655cd837ced1b1a57d548466aba3d1758835dcf59d371b5cbdbb372521de50ddcbca6371771b8cee01a34cde5ad671e1017f4020
SSDEEP 384:n5iFiZcID8NLZ8TUNTUlIRHPvuTbjtEqfbYGGpe+DLCxsY9ivSx8LEEIzvo9:QFQDQZwgRuzYGGNQsGia/+
TLSH
T1E1E2A3F198D78977D89E4B87677D6D069AFCD163B4888984BBC44D0CCC861BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 74d6812e5dcff5a2ac10fbb7b92f0269f2fa213fb58fdd0f05aa72e1ca423959
MD5 6f255416aa676ff452c1ad50e52624db
SHA1 63ba708330e42f721c8962f24f896dc09fac6057
SHA512 ee127a2ba4b03d5485f3fbe62f58d4360da1849bdc673b165eada0260bef2e248c4ce39ed7feb9fbbf4bec24299d5236f84234ac50f9de29ee1cd346517f88d2
SSDEEP 384:nIiF1tNn/s3n9Sn8Ngm8TUNTUlIRiPvuTuZREqfbYGGpeKLNOObjI9G6w738LEEy:TF1j+9SXmwgUuIUGGrN29MJ
TLSH
T187C24B32EC59CAB7EDEB4F99B74A7A46EEE01167849C5AC8DAD85D0C00C71ED4307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2a88933f055978843f26d6c6b10328d271ee64738b9ed8e73cba4f1d30683f6b
MD5 5c5d975bdc14ad3dfad73f6792f48ec2
SHA1 d1011daca5ac2454183c576b02a9f70d72eaea75
SHA512 b358b07dca5018911d8c6bd79b209cb5ae023e112581710ec5b51e4d01c0a15f3c33a5435e2c9d2fdb9d090037773652e15e14a1818abe9fdbcbc47fefc09f10
SSDEEP 384:n9iFiZcIo8NLZ8TUNTUlIRHPvuTHTtEqfbYGGpe+DLKksY9ivSx8LEEIzvo9:0FQoQZwgRuXYGGNzsGia/+
TLSH
T1D1C24B32D868CEB7ACEA9FD5B7497646EEE411A3C4CD89D8DAD55E0C00871EE070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0b11fc39d9362d52596d79665104748a718c5a458ddd162cf201c32b3f4c43e5
MD5 fe6415fb9d2473e81e2cd0f0854680de
SHA1 3592a2c8f5d22367eab59e69820f278baf377f08
SHA512 c0975086d0833fc2dc643d6c528ed1b947b2635c41d21e2f1018060a433bc9a049f9a7ca7477f546108b72a725797414d530dd6f092c4b1c9dec91450b9cd450
SSDEEP 384:nwiF1tNn/s3n9Sn8NgZ8TUNTUlIRiPvuTh/tEqfbYGGpe+DLKksY9OObjI9G6w7J:LF1j+9SXZwgUuNYGGNzsG29MJ
TLSH
T183D24C36E859CEB7EDEB8F99B34A7646DEE012A7C48C5AD8DAD45D0C00C71AD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9ea5526311b546e40f7cb0a60337403364d2fc97a6a67bddcd0ecbb79fa701c3
MD5 681ee1723aded13d07861645222ae8b4
SHA1 441752b6ec2e0a61625e573f7f54efabd84306e1
SHA512 d364176dcd67b3e7b7bbde1b344563920950e6198fc38e65cbd74147a094284da4d9abff2e1e50a6086464e3bb12bb1f13fc07ecbf698e9d61de8ed0a2b065dd
SSDEEP 384:n5iFiZcIo8NLZ8TUNTUlIRHPvuTbTtEqfbYGGpe+DLKVsY9ivSx8LEEIzvo9:QFQoQZwgRujYGGNwsGia/+
TLSH
T131C24B32D868CEB7ACEA9FD5B7497646EEE411A3C4CD89D8DAD95E0C00871ED070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 26b91053fa5665c7f9dfbb70dfa8cf3e30ff195b27be968ac53fffddc337337e
MD5 f36fd20686b0cd08c1cc0cc0d1748528
SHA1 40bbca940bb397d8fef4133608ca78249c95c275
SHA512 4fa2c486c992eca274f7376f10e9a676e97bac60efdc8a18b36871bcfed51fe128d520e6e1742bd6698b2073c0305ec0e71c7ef1aa6c873a54118b55d6f8a219
TLSH
T1D85150E04C3C16D1D4BD0E3EB08739FC81EC9725F890343C6859EA585A7A21D309083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 25afb2f2bbaa4983e1dd9fbc7dbd3db3c6f90ba68a4da5cfa259e6125d7af563
MD5 df226db3e0bb4123ee114425d619b135
SHA1 8982e45bd0925562b0eae483d5f2134f34d13e37
SHA512 4ed768186ed4a8d0c2e88df140b8060a245ffc7383420454a9370e53e35b18248d0ebe303f8e0b57396fccb6bee2cd4e2aaaa633a45e7d4cd783999bf62c713c
TLSH
T1E7513DE04C381AC1D4BD0E6FB45B79FC85ECC726F4A0347D6858EA985A7A65D318483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 08a293f1583d129c9e975f00f9f365bb366b9023bcc15b3612fa8cb7a3ef3e15
MD5 6a812c11f55f0456e0e0b26731680073
SHA1 843157812ee131255015c3bfa9b8c1411934d3f9
SHA512 00f516a51d1a92f8d24d8bde435a82a3ad9996b99efbbc760c7c172fcd6bd4708c0c59832474b40d0c3b04625d3fa60050b627fe415365d339382115061f24d1
TLSH
T11C515FE04C381AD1D4FD0E7EB48B78FC81EC9726F890343C6858EA985A7A21D349483F
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/772-203-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1100-551-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1340-216-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1752-183-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1856-661-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2456-625-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2580-463-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2804-586-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4164-555-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4184-519-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4276-504-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4768-515-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5476-665-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5496-590-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5512-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5724-610-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6908-511-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/7016-649-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/7060-614-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/7060-628-0x0000000000010000-0x0000000000083000-memory.dmp

Download